Coldcard Hack Update: No New Movement as of September 1

Every entry in this series so far has tracked a number that was climbing, whether it was the total stolen, the address count, or the dollar value. Today's update is different: nothing moved. That is itself useful information for anyone still trying to work out what the attackers are likely to do next with the roughly 1,531 BTC that has sat untouched in their wallets for weeks.

What the Three Tracked Positions Show Today

Investigators have narrowed in on a small number of specific wallets and transfers as the most likely places to see the attackers' next move, precisely because so much of the stolen Bitcoin has stayed put rather than being cashed out. As of September 1, all three show the same pattern: no change.

Source: TRM Labs, on-chain tracking data. Data as of September 1, 2026.

The 562 BTC address is worth watching closely simply because of its size: 11 unspent outputs sitting in one place is a large, single, trackable position rather than funds already scattered across hundreds of smaller wallets. As covered in earlier entries in this series, attackers running this kind of exploit generally choose between two strategies, either sweeping many victims into a handful of large collection addresses, or splitting proceeds thin across many wallets to make tracing harder. A wallet this size sitting idle for weeks is the first strategy playing out in slow motion.

Why the Wasabi Transfer Still Matters Most

Of everything Galaxy Research and TRM Labs have been able to trace to an actual endpoint, the 64.9 BTC CoinJoin transfer through Wasabi remains the single largest piece. That matters because CoinJoin transactions are specifically designed to break the link between where coins came from and where they end up, by bundling many different users' transactions together so that outside observers cannot cleanly separate one person's coins from another's. A transfer into a CoinJoin round is not the same as cashing out. It is closer to the funds entering a queue where tracing gets harder, not a queue where the money has actually landed anywhere spendable yet. That no new exchange destination has been confirmed since means the trail, for now, still ends inside that privacy layer rather than at a service that could realistically be compelled to identify who withdrew the funds.

What This Means for the Broader Case

TRM Labs' own framing, echoed across its coverage of this exploit, is that laundering activity so far has been limited relative to the overall scale of the theft. That assessment still holds today. The bulk of what was stolen is not the 64.9 BTC that moved through Wasabi or the 30.185 BTC that moved on August 7. It is the far larger balance that has not moved at all.

That is also why the overall total keeps being described as a range rather than a settled figure. TRM's detailed on-chain assessment, built from confirmed wave and footprint data, sits around 1,816 BTC. Separate, broader reporting has floated a ceiling above $130 million once currently unattributed clusters are accounted for. Both figures can be correct at the same time, since one reflects what has been rigorously confirmed and the other reflects what investigators think is plausible once the remaining forensic work is done. As with every previous update in this series, that gap is expected to narrow, not because new theft is occurring, but because tracing existing addresses back to the same March 2021 flaw is still ongoing.

What to Watch Next

With attack activity itself having stopped appearing after August 6, the story from here is almost entirely about what the attackers do with the funds they are already sitting on. A change at any of the three tracked positions above, particularly a new spend from the 562 BTC address, would be the clearest early signal that a laundering or cash-out attempt is underway. Until then, the unmoved balance remains the window law enforcement and exchanges have to prepare for that moment before it arrives.